{"affected":[{"ecosystem_specific":{"binaries":[{"osc":"1.9.0-150400.10.6.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","name":"osc","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"osc":"1.9.0-150400.10.6.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","name":"osc","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"osc":"1.9.0-150400.10.6.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"osc","purl":"pkg:rpm/opensuse/osc&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"osc":"1.9.0-150400.10.6.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.6","name":"osc","purl":"pkg:rpm/opensuse/osc&distro=openSUSE%20Leap%2015.6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for osc fixes the following issues:\n\n- 1.9.0\n  - Security:\n    - Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911)\n      Source files are now stored in the 'sources' subdirectory which prevents\n      name collisons. This requires changing version of '.osc' store to 2.0.\n  - Command-line:\n    - Introduce build --checks parameter\n  - Library:\n    - OscConfigParser: Remove automatic __name__ option\n\n- 1.8.3\n  - Command-line:\n    - Change 'repairwc' command to always run all repair steps\n  - Library:\n    - Make most of the fields in KeyinfoPubkey and KeyinfoSslcert models optional\n    - Fix colorize() to avoid wrapping empty string into color escape sequences\n    - Provide default values for kwargs.get/pop in get_results() function\n\n- 1.8.2\n  - Library:\n    - Change 'repairwc' command to fix missing .osc/_osclib_version\n    - Make error message in check_store_version() more generic to work for both projects and packages\n    - Fix check_store_version in project store\n\n- 1.8.1\n  - Command-line:\n    - Fix 'linkpac' command crash when used with '--disable-build' or '--disable-publish' option\n\n- 1.8.0\n  - Command-line:\n    - Improve 'submitrequest' command to inherit description from superseded request\n    - Fix 'mv' command when renaming a file multiple times\n    - Improve 'info' command to support projects\n    - Improve 'getbinaries' command by accepting '-M' / '--multibuild-package' option outside checkouts\n    - Add architecture filtering to 'release' command\n    - Change 'results' command so the normal and multibuild packages have the same output\n    - Change 'results' command to use csv writer instead of formatting csv as string\n    - Add couple mutually exclusive options errors to 'results' command\n    - Set a default value for 'results --format' only for the csv output\n    - Add support for 'results --format' for the default text mode\n    - Update help text for '--format' option in 'results' command\n    - Add 'results --fail-on-error/-F' flag\n    - Redirect venv warnings from stderr to debug output\n  - Configuration:\n    - Fix config parser to throw an exception on duplicate sections or options\n    - Modify conf.get_config() to print permissions warning to stderr rather than stdout\n  - Library:\n    - Run check_store_version() in obs_scm.Store and fix related code in Project and Package\n    - Forbid extracting files with absolute path from 'cpio' archives (bsc#1122683)\n    - Forbid extracting files with absolute path from 'ar' archives (bsc#1122683)\n    - Remove no longer valid warning from core.unpack_srcrpm()\n    - Make obs_api.KeyinfoSslcert keyid and fingerprint fields optional\n    - Fix return value in build build.create_build_descr_data()\n    - Fix core.get_package_results() to obey 'multibuild_packages' argument\n  - Tests:\n    - Fix tests so they don't modify fixtures\n\n- 1.7.0\n  - Command-line:\n    - Add 'person search' command\n    - Add 'person register' command\n    - Add '-M/--multibuild-package' option to '[what]dependson' commands\n    - Update '-U/--user' option in 'maintainer' command to accept also an email address\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Fix 'maintainer --devel-project' to raise an error if running outside a working copy without any arguments\n    - Fix handling arguments in 'service remoterun prj/pac'\n    - Fix 'rebuild' command so the '--all' option conflicts with the 'package' argument\n    - Fix crash when removing 'scmsync' element from dst package meta in 'linkpac' command\n    - Fix crash when reading dst package meta in 'linkpac' command\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n    - Improve 'updatepacmetafromspec' command to expand rpm spec macros by calling rpmspec to query the data\n    - Improve 'build' and 'buildinfo' commands by uploading *.inc files to OBS for parsing BuildRequires (bsc#1221340)\n    - Improve 'service' command by printing names of running services\n    - Improve 'getbinaries' command by ignoring source and debuginfo filters when a binary name is specified\n    - Change 'build' command to pass '--jobs' option to 'build' tool only if 'build_jobs' > 0\n    - Clarify 'list' command's help that that listing binaries doesn't contain md5 checksums\n    - Improve 'log' command: produce proper CSV and XML outputs, add -p/--patch option for the text output\n    - Allow setlinkrev to set a specific vrev\n    - Document '--buildtool-opt=--noclean' example in 'build' command's help\n    - Fix handling the default package argument on the command-line\n  - Configuration:\n    - Document loading configuration from env variables\n  - Connection:\n    - Don't retry on error 400\n    - Remove now unused 'retry_on_400' http_request() option from XmlModel\n    - Revert 'Don't retry on 400 HTTP status code in core.server_diff()'\n    - Revert 'connection: Allow disabling retry on 400 HTTP status code'\n  - Authentication:\n    - Update SignatureAuthHandler to support specifying ssh key by its fingerprint\n    - Use ssh key from ssh agent that contains comment 'obs=<apiurl-hostname>'\n    - Use strings instead of bytes in SignatureAuthHandler\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n    - Remove unused SignatureAuthHandler.get_fingerprint()\n  - Library:\n    - Add rootless build support for 'qemu' VM type\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n    - Add XmlModel class that encapsulates manipulation with XML\n    - Add obs_api.Person.cmd_register() for registering new users\n    - Fix conf.get_config() to ignore file type bits when comparing oscrc perms\n    - Fix conf.get_config() to correctly handle overrides when env variables are set\n    - Fix output.tty.IS_INTERACTIVE when os.isatty() throws OSError\n    - Improve cmdln.HelpFormatter to obey newline characters\n    - Update list of color codes in 'output.tty' module\n    - Remove core.setDevelProject() in favor of core.set_devel_project()\n    - Move removing control characters to output.sanitize_text()\n    - Improve sanitize_text() to keep selected CSI escape sequences\n    - Add output.pipe_to_pager() that pipes lines to a pager without creating an intermediate temporary file\n    - Fix output.safe_write() in connection with NamedTemporaryFile\n    - Modernize output.run_pager()\n    - Extend output.print_msg() to accept 'error' and 'warning' values of 'to_print' argument\n    - Add XPathQuery class for translating keyword arguments to an xpath query\n    - Add obs_api.Keyinfo class\n    - Add obs_api.Package class\n    - Add Package.get_revision_list() for listing commit log\n    - Add obs_api.PackageSources class for handling OBS SCM sources\n    - Add obs_api.Person class\n    - Add obs_api.Project class\n    - Add obs_api.Request class\n    - Add obs_api.Token class\n    - Allow storing apiurl in the XmlModel instances\n    - Allow retrieving default field value from top-level model\n    - Fix BaseModel to convert dictionaries to objects on retrieving a model list\n    - Fix BaseModel to always deepcopy mutable defaults on first use\n    - Implement do_snapshot() and has_changed() methods to determine changes in BaseModel\n    - Implement total ordering on BaseModel\n    - Add comments with available attributes/elements to edited XML\n  - Refactoring:\n    - Migrate repo {list,add,remove} commands to obs_api.Project\n    - Migrate core.show_package_disabled_repos() to obs_api.Package\n    - Migrate core.Package.update_package_meta() to obs_api.Package\n    - Migrate core.get_repos_of_project() to obs_api.Project\n    - Migrate core.get_repositories_of_project() to obs_api.Project\n    - Migrate core.show_scmsync() to obs_api.{Package,Project}\n    - Migrate core.set_devel_project() to obs_api.Package\n    - Migrate core.show_devel_project() to obs_api.Package\n    - Migrate Fetcher.run() to obs_api.Keyinfo\n    - Migrate core.create_submit_request() to obs_api.Request\n    - Migrate 'token' command to obs_api.Token\n    - Migrate 'whois/user' command to obs_api.Person\n    - Migrate 'signkey' command to obs_api.Keyinfo\n    - Move print_msg() to the 'osc.output' module\n    - Move run_pager() and get_default_pager() from 'core' to 'output' module\n    - Move core.Package to obs_scm.Package\n    - Move core.Project to obs_scm.Project\n    - Move functions manipulating store from core to obs_scm.store\n    - Move store.Store to obs_scm.Store\n    - Move core.Linkinfo to obs_scm.Linkinfo\n    - Move core.Serviceinfo to obs_scm.Serviceinfo\n    - Move core.File to obs_scm.File\n    - Merge _private.project.ProjectMeta into obs_api.Project\n  - Spec:\n    - Remove dependency on /usr/bin/python3 using %python3_fix_shebang macro (bsc#1212476)\n\n- 1.6.2\n  - Command-line:\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n  - Authentication:\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n  - Library:\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n\n- 1.6.1\n  - Command-line:\n    - Use busybox compatible commands for completion\n    - Change 'wipe' command to use the new get_user_input() function\n    - Fix error 500 in running 'meta attribute <prj>'\n  - Configuration:\n    - Fix resolving config symlink to the actual config file\n    - Honor XDG_CONFIG_HOME and XDG_CACHE_HOME env vars\n    - Warn about ignoring XDG_CONFIG_HOME and ~/.config/osc/oscrc if ~/.oscrc exists\n  - Library:\n    - Error out when branching a scmsync package\n    - New get_user_input() function for consistent handling of user input\n    - Move xml_indent, xml_quote and xml_unquote to osc.util.xml module\n    - Refactor makeurl(), deprecate query taking string or list arguments, drop osc_urlencode()\n    - Remove all path quoting, rely on makeurl()\n    - Always use dict query in makeurl()\n    - Fix core.slash_split() to strip both leading and trailing slashes\n\n- 1.6.0\n  - Command-line:\n    - The 'token --trigger' command no longer sets '--operation=runservice' by default.\n    - Change 'token --create' command to require '--operation'\n    - Fix 'linkdiff' command error 400: prj/pac/md5 not in repository\n    - Update 'build' command to support building 'productcompose' build type with updateinfo.xml data\n    - Don't show meter in terminals that are not interactive\n    - Fix traceback when running osc from an arbitrary git repo that fails to map branch to a project (bsc#1218170)\n  - Configuration:\n    - Implement reading credentials from environmental variables\n    - Allow starting with an empty config if --configfile is either empty or points to /dev/null\n    - Implement 'quiet' conf option\n    - Password can be an empty string (commonly used with ssh auth)\n  - Connection:\n    - Allow -X HEAD on osc api requests as well\n  - Library:\n    - Fix credentials managers to consistently return Password\n    - Fix Password.encode() on python < 3.8\n    - Refactor 'meter' module, use config settings to pick the right class\n    - Convert to using f-strings\n    - Use Field.get_callback to handle quiet/verbose and http_debug/http_full_debug options\n    - Implement get_callback that allows modifying returned value to the Field class\n    - Add support for List[BaseModel] type to Field class\n    - Report class name when reporting an error during instantiating BaseModel object\n    - Fix exporting an empty model field in  BaseModel.dict()\n    - Fix initializing a sub-model instance from a dictionary\n    - Implement 'Enum' support in models\n    - Fix Field.origin_type for Optional types\n    - Drop unused 'exclude_unset' argument from BaseModel.dict() method\n    - Store cached model defaults in self._defaults, avoid sharing references to mutable defaults\n    - Limit model attributes to predefined fields by forbidding creating new attributes on fly\n    - Store model values in self._values dict instead of private attributes\n  - Spec:\n    - Recommend openssh-clients for ssh-add that is required during ssh auth\n    - Add 0%{?amzn} macro that wasn't usptreamed\n","id":"SUSE-SU-2024:2961-1","modified":"2024-08-19T12:06:41Z","published":"2024-08-19T12:06:41Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242961-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1122683"},{"type":"REPORT","url":"https://bugzilla.suse.com/1212476"},{"type":"REPORT","url":"https://bugzilla.suse.com/1218170"},{"type":"REPORT","url":"https://bugzilla.suse.com/1221340"},{"type":"REPORT","url":"https://bugzilla.suse.com/1225911"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22034"}],"related":["CVE-2024-22034"],"summary":"Security update for osc","upstream":["CVE-2024-22034"]}